Getting Data In

running permissions for splunk user of forwarder on linux and solaris

fernandoandre
Communicator

Hi

I have some universal forwaders installed on linux (suse) and solaris.

I have a user "splunk" to log to those machines and make restart to the forwarder service if necessary.

However, if I do that with splunk user, the forwarder stops sending data to my Indexer. If however I do that with a root user, the forwarder starts sending data again to Indexer.

What are the permissions a user needs to controls the splunk forwarder service in a *nix machine??

(this doesnt help - http://docs.splunk.com/Documentation/Splunk/4.3/installation/RunSplunkasadifferentornon-rootuser)

Thank you

0 Karma
1 Solution

fernandoandre
Communicator

Problem solved!
The user need read permissions to the folder where logs are being written (which it didn't have)! It doesn't have to do with the permissions for starting/stopping the service of the forwarder.

View solution in original post

0 Karma

fernandoandre
Communicator

Problem solved!
The user need read permissions to the folder where logs are being written (which it didn't have)! It doesn't have to do with the permissions for starting/stopping the service of the forwarder.

0 Karma

krishnacasso
Path Finder

Can you please guide how you assigned the permissions to log file. I used chmod to assign the read permissions but it is not working. When the file get rolled over the permissions were not carried so forwarder stops sending the data.

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...